Skip to main content
Reverse Engineering

Return to Question

edited tags
Link
NirIzr
NirIzr
  • 11.8k
  • 1
  • 38
  • 87
edited tags
Source Link
aMa
aMa
  • 303
  • 2
  • 4
  • 8

I am trying to unpack a DLL and fix the import tables with ImpRec. However, I am stuck with this error. Following is what I have tried.

  1. Modified the flag in its PE header so that windows loads the file as an exe, not a dll.
  2. Loaded to Immunity Debugger and found the real entry point(Entry point of unpacked binary)
  3. Dumped the the binary at this entry point.
  4. Now I opened ImpREC to fix the import table of the of the dumped DLL. However, in ImpREC the base memory displayed is 7100000. When I give the 068BA2A0."068BA2A0" as entry point, ImpRec complaints invalid OEP!. I dont understand how the base address of the debugged process is "7100000". I suspect this could be the problem.

enter image description here

Why is this error? Any pointers to fix it?

I am trying to unpack a DLL and fix the import tables with ImpRec. However, I am stuck with this error. Following is what I have tried.

  1. Modified the flag in its PE header so that windows loads the file as an exe, not a dll.
  2. Loaded to Immunity Debugger and found the real entry point(Entry point of unpacked binary)
  3. Dumped the the binary at this entry point.
  4. Now I opened ImpREC to fix the import table of the of the dumped DLL. However, in ImpREC the base memory displayed is 7100000. When I give the 068BA2A0. ImpRec complaints invalid OEP!

enter image description here

Why is this error? Any pointers?

I am trying to unpack a DLL and fix the import tables with ImpRec. However, I am stuck with this error. Following is what I have tried.

  1. Modified the flag in its PE header so that windows loads the file as an exe, not a dll.
  2. Loaded to Immunity Debugger and found the real entry point(Entry point of unpacked binary)
  3. Dumped the the binary at this entry point.
  4. Now I opened ImpREC to fix the import table of the of the dumped DLL. However, in ImpREC the base memory displayed is 7100000. When I give "068BA2A0" as entry point, ImpRec complaints invalid OEP!. I dont understand how the base address of the debugged process is "7100000". I suspect this could be the problem.

enter image description here

Why is this error? Any pointers to fix it?

edited tags
Source Link
aMa
aMa
  • 303
  • 2
  • 4
  • 8

Unpacking Fixing import table of unpacked DLL with ImpREC and Immunity : ImpRec throws invalid"invalid OEP!" error

I am trying to unpack a DLL and fix the import tables with ImpRec. FollowingHowever, I am stuck with this error. Following is what I have tried.

  1. Modified the flag in its PE header so that windows loads the file as an exe, not a dll.
  2. Loaded to Immunity Debugger and found the real entry point(Entry point of unpacked binary)
  3. Dumped the the binary at this entry point.
  4. Now I opened ImpREC to fix the import table of the of the dumped DLL. However, in ImpREC the base memory displayed is 7100000. When I give the 068BA2A0. ImpRec complaints invalid OEP!

enter image description here

Why is this error? Any pointers?

Unpacking DLL with ImpREC and Immunity : ImpRec throws invalid OEP error

I am trying to unpack a DLL. Following is what I have tried.

  1. Modified the flag in its PE header so that windows loads the file as an exe, not a dll.
  2. Loaded to Immunity Debugger and found the real entry point(Entry point of unpacked binary)
  3. Dumped the the binary at this entry point.
  4. Now I opened ImpREC to fix the import table of the of the dumped DLL. However, in ImpREC the base memory displayed is 7100000. When I give the 068BA2A0. ImpRec complaints invalid OEP!

enter image description here

Why is this error? Any pointers?

Fixing import table of unpacked DLL with ImpREC : ImpRec throws "invalid OEP!" error

I am trying to unpack a DLL and fix the import tables with ImpRec. However, I am stuck with this error. Following is what I have tried.

  1. Modified the flag in its PE header so that windows loads the file as an exe, not a dll.
  2. Loaded to Immunity Debugger and found the real entry point(Entry point of unpacked binary)
  3. Dumped the the binary at this entry point.
  4. Now I opened ImpREC to fix the import table of the of the dumped DLL. However, in ImpREC the base memory displayed is 7100000. When I give the 068BA2A0. ImpRec complaints invalid OEP!

enter image description here

Why is this error? Any pointers?

Source Link
aMa
aMa
  • 303
  • 2
  • 4
  • 8